All Apps and Add-ons

What does the "cancelled" attribute donate when capturing TCP flows using Stream App?

twigat
Engager

Hi Everyone,

I have a question regarding the fields returned by Splunk App for Stream. I've configured a number of TCP flow monitors and I see some flows have a "cancelled" attribute.

I couldn't find any documentation about what this field's purpose is, could this be that an RST was sent instead of a FIN|FIN/ACK for a TCP flow? Any other definitions I'm not considering?

0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi,

You're correct - "cancelled" means that the flow was terminated with an RST.

As for where to get the documentation - if you go to the Configuration -> Configure Streams page inside the App for Stream UI and click on a stream, you'll see a list of fields you can enable/disable/etc. Each field there has a description column that provides some info about the field.

View solution in original post

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi,

You're correct - "cancelled" means that the flow was terminated with an RST.

As for where to get the documentation - if you go to the Configuration -> Configure Streams page inside the App for Stream UI and click on a stream, you'll see a list of fields you can enable/disable/etc. Each field there has a description column that provides some info about the field.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...